I recently launched a new site on an already existing domain, using new hosting. The previous site utilized HTTPS, the new site does not (just HTTP).

The problem I've ran into is that Google currently has the site indexed as HTTPS. The site is in WordPress, I've tried to 301 redirect HTTPS URLs to HTTP with htaccess (placing rules above the WordPress rules), with no success. The HTTPS version displays the security warning of course (as there is no SSL certificate) and then a 404 if you go past that.

Here is what the htaccess file currently looks like:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} ^443$
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

I've tried other rules as well to redirect the traffic with no luck. Additionally, Google Chrome still redirects example.com to https://example.com, no amount of clearing cache resolves this issue. All other browsers work fine, www.example.com works as expected in all browsers.

Has anyone else experienced these issues when moving a domain away from HTTPS? Is there a standard way available to notify Google of the change?

  • 5
    I suggest you put the effort you want to do in enabling https, not in trying to get it out. If your host doesn't allow for https, it's (IMO) a bad hoster and you should move. – Martijn Aug 24 '16 at 8:23

Why not get a free SSL certificate from Lets Encrypt, then your https will work. Ride the horse in the direction it is going...

  • It's not only free but incredibly easy to install using their automated script. I highly recommend it. – L Martin Aug 24 '16 at 8:09

(Just a guess.)

If the old site used HSTS, you have to wait the number of seconds that were specified in max-age until users that visited the HTTPS version can visit the HTTP version again.

(If HTTPS would still work, you could send the HSTS header and specify a very short max-age, and after most users visited again, stop sending the header, and then transition to HTTP.)

You could remove the domain from your browser’s HSTS Policy cache, but this would of course only help you, not your visitors (unless they do the same). In Chrome/Chromium, you should be able to access the cache under the address chrome://net-internals/#hsts; there you can delete your domain.¹

¹ I guess this doesn’t work if your domain is included in the preload list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.